34ad998a3b94f2a38d2904b1504c5f1ad0cc168987b7b443dc0a2540602ffa0e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

017ef54ba806fefaf8f533ae93038759_JaffaCakes118.pdf
Size

82KB
MD5

017ef54ba806fefaf8f533ae93038759
SHA1

585c83143ec8ea037f9ee56408b8d26293dace4c
SHA256

34ad998a3b94f2a38d2904b1504c5f1ad0cc168987b7b443dc0a2540602ffa0e
SHA512

df34cca7cceb8d616f7f002c64e7a4e47774ad30824005476494e79ca41acd508f98d300a55e8e1103cdb904790a61e97c47b3336359280f4d7d72d82b77a271
SSDEEP

1536:0KczNgK+yx/8TjmhRMzMAGpAiFtdf3j2gYxjjFvByXXhYrjZegAsg:D4mKdGHmhO0Ftdfz2TxjjlB+Xh6ZW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2444	AcroRd32.exe
2444	AcroRd32.exe
2444	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\017ef54ba806fefaf8f533ae93038759_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9df129265a2d93677ca3fa907be432ef

SHA1
a417dd6d291f31fdf661456f1d264840e6cbee2c

SHA256
dd8d517199a54f69d053161a6ab1c3aab7990a3f9c444bc01b0f1f9081b8481d

SHA512
a0d5852f031da1f26992317067ae04c44240362ce741b0b2a24628364b68526c42506a242719b2d9d84ee9ff72b1edf48295db978d31e0388c13d097c43d77ea

Download Submit